Association for Information Systems AIS Electronic Library (AISeL) ICIS 2006 Proceedings International Conference on Information Systems (ICIS) December 2006 Assuring IT Services Quality through High- Reliability Risk Management in Offshore Business Process Outsourcing Jessica Pu State University of New York at Buffalo Rajiv Kishore State University of New York at Buffalo Follow this and additional works at: http://aisel.aisnet.org/icis2006 Recommended Citation Pu, Jessica and Kishore, Rajiv, "Assuring IT Services Quality through High-Reliability Risk Management in Offshore Business Process Outsourcing" (2006). ICIS 2006 Proceedings. 79. http://aisel.aisnet.org/icis2006/79 This material is brought to you by the International Conference on Information Systems (ICIS) at AIS Electronic Library (AISeL). It has been accepted for inclusion in ICIS 2006 Proceedings by an authorized administrator of AIS Electronic Library (AISeL). For more information, please contact elibrary@aisnet.org.
ASSURING IT SERVICES QUALITY THROUGH HIGH- RELIABILITY RISK MANAGEMENT IN OFFSHORE BUSINESS PROCESS OUTSOURCING Social, Behavioral and Organizational Aspects of Information Systems Jessica Pu Li 1 State University of New York at Buffalo puli@buffalo.edu Rajiv Kishore 1 State University of New York at Buffalo rkishore@buffalo.edu Abstract Management of risks that emanate from offshore IT-enabled services outsourcing is a key challenge in the IT management area in current times. These new risks need to be addressed through the development of new risk management frameworks and methods. This paper proposes a risk management approach for offshore business process outsourcing based on the principles of high reliability organizations (HROs). Relying upon and using the organizing principles and mechanisms for HROs may help companies successfully combat the risks associated with offshore outsourcing. The proposed research model is planned to be empirically tested using data collected from offshore business process outsourcing projects of client firms in the US. Keywords: Risk, offshore outsourcing, high reliability organizations (HROs), mindfulness Background and Motivation Offshore outsourcing, or simply offshoring, of IT-enabled services to the Asia Pacific region has become quite pervasive in recent years, and almost all large-sized companies in the US and other developed countries now routinely offshore some of their IT activities and business processes to offshore locations in the Asia Pacific, most notably to India but also to China, Philippines, and Singapore among other locations. IT-enabled services outsourcing spans both business process outsourcing (BPO) and knowledge process outsourcing (KPO) activities and includes the outsourcing of such activities as customer service contact centers, accounting and tax preparation, supply chain management, software product development, technical design and development, and technical and financial research, etc. The labor cost arbitrage and the availability of highly-trained workers in many of the offshore locations in the Asia Pacific region has further fueled the offshoring phenomenon. Estimates vary but by all estimates the offshore outsourcing market is huge. For example, NASSCOM, the IT industry trade association in India, estimated the export of IT-enabled services from India in 2005 to the tune of US$ 22 billion and projected this revenue to go up to US$28.5 billion in 2006 (www.nasscom.org). Gartner, a premier IT research and advisory firm in the US, estimated the offshore market of IT services to the tune of US$536 billion in 2003 with an annual growth rate of 6.2% (Carmel and Tjia 2005). While offshore outsourcing provides several strategic advantages to a firm including labor cost savings, speed and agility due to a nearly 24-hour work cycle (due to time zone differences), and access to world-class talent in ITrelated fields, the phenomenon of offshoring is fraught with several risks, some specifically emanating from the globally-distributed nature of IT work performed at offshore vendor locations. These new risks emanate from several underlying factors including differences in social, cultural, legal, and regulatory systems in offshore countries as well as from the geographical distances, time zone differences, and globally-distributed nature of work. For example, cultural norms about joint families, shared property rights, and collectivism in many Asian countries 1 Both authors contributed equally to this paper and their names are listed in a random order. Twenty-Seventh International Conference on Information Systems, Milwaukee 2006 1287
Social, Behavioral and Organizational Aspects of Information Systems leads to a general belief in those countries that software can be freely shared and this has led to software piracy in many developing countries (Gopal and Sanders 1998) as well as loss of intellectual property (IP) for many companies. A recent example of loss of IP is the development of a new car model named QQ by Cheri Automobiles of China which General Motors China claims is a near replica of one of their new car models that was recently developed by them for the Chinese market. Other criminal risks including loss of data security and privacy from theft of data and insertion of malicious code in software systems are also more likely in offshore outsourcing because legal and regulatory systems in many offshoring countries are not well developed. It has been recently noted that terrorists are likely to penetrate offshore outsourcing firms and are likely to engage in such criminal behavior in the years to come (Carmel and Tjia 2005). Further, several common outsourcing risks such as vendor opportunism and knowledge transfer are exacerbated to a great extent due to complexities in coordination and control of projects and services in a offshorely-distributed work environment. Though offshoring has mushroomed in recent years, not all offshore projects are successful. In many trade circles, India has become an acronym for I ll Never Do It Again (Carmel and Tjia 2005). The complexities and risks involved in offshoring need to be managed effectively to reap the strategic benefits from offshoring that are often cited. The research proposed in this proposal seeks to develop a comprehensive framework of offshoring risks and to develop a methodology for offshore risk management based on the theory and principles of high reliability organizations (HROs) (Bigley and Roberts 2001; Roberts 1990; Waller and Roberts 2003). The rest of this paper is organized as follows. The theoretical underpinnings for this research are outlined next. The research model and hypotheses are described in section 3. Section 4 offers the planned research methodology for conceptual model validation process. Finally, some concluding remarks are given in section 5. Theoretical Underpinning Theories of high reliability organizations (HROs) have been proposed in the recent past (e.g. Bigley and Roberts 2001; Roberts 1990; Waller and Roberts 2003). HROs are essentially organizations that operate high-hazard technologies such as a nuclear power plant, air traffic control, etc. These organizations are characterized by complex tasks, intensive interactions among organizational actors, and highly unpredictable situations which results in high degrees of risks that are systemic in nature and are pervasive in various organizational work processes (Weick and Sutcliffe 1999). Nonetheless, barring exceptions, these organizations are able to produce organizational outcomes and results of the required minimum quality with a high degree of reliability, i.e., in a repeated and regular manner (Hannan and Freeman 1984) and are, therefore, called high reliability organizations. Recently, some researchers (e.g. Grabowski and Roberts 1999; Ramanujam and Goodman 2003; Vogus and Welbourne 2003; Waller and Roberts 2003) have suggested that the principles of HROs can be applied in main-stream organizations as well. Nowadays organizations increasingly become reliability-seeking: continuously and effectively staying ahead of competitors and technological obsolescence through vigilance and intense innovation in an extremely unpredictable and fluctuating environment (Vogus and Welbourne, 2003). Weick et al. (1999) call HROs harbingers of adaptive organizational forms that can be used in increasingly complex environments that most business organizations face today. These authors have proposed a critical HRO cognitive mechanism termed collective mindfulness that, if carefully managed, can both increase the comprehension of complexity by organizational actors and loosen tight coupling among several interdependent activities, thereby promoting the effective management of the systemic risks that pervade various processes in HROs. The five processes of collective mindfulness are: Preoccupation with failure actors in HROs are continuously wary of failures and potential surprises, Reluctance to simplify interpretations actors in HROs actively seek out multiple and divergent viewpoints and Perspectives to understand current situation rather than depend on one single dominant perspective, Sensitivity to operations actors in HROs try to comprehend and understand the meaning of the current moment within an integrated framework of the overall situation, Commitment to resilience actors in HROs are able to cope with dangers that have occurred through resilience and are able to bounce back from errors and mistakes through constrained improvisation, and Under-specification of structures HROs are characterized by fluid rather than rigid and minimal rather than highly-specified structures so that flexible and fluid decision making to cope with errors and dangers of the moment is possible. 1288 Twenty-Seventh International Conference on Information Systems, Milwaukee 2006
Li & Kishore/Assuring Offshore IT Service Quality through HRO Complex socio-technical systems are characterized by interactive complexity and tight coupling (Perrow 1984) and they are increasingly subject to systemic risk (Carlo et al. 2004). According to Perrow (1984), the five processes mentioned above can counter the dreaded combination of interactive complexity and tight coupling associated with normal accidents. Mindfulness can both increase the comprehension of complexity and loosen tight coupling (Weick et al. 1999). People preoccupied with failure have more complex interactions with the system and create multiple paths for task performance. People who are reluctant to simplify interpretations pay close attentions to the details of complexity and see alternative approaches to avoid unexpected outcomes. People who maintain sensitivity to operations see more interconnections and they can make adjustment to loosen time-dependencies and tight coupling. People who develop capabilities for resilience can stay tuned to unfolding events, and resilient systems could create alternative means to a goal. And people who loosen hierarchical access structures touch the problems more closely and more quickly to experience and expertise, and reduce the likelihood of tightened coupling by isolating problems. Mindfulness allows people to experience a phenomenon in a discriminating manner and enables them to manage a simultaneous occurrence of events they have never seen before (Weick et al. 1999). The five processes of mindfulness are tied together as they induce a rich awareness of discriminatory detail and provide organizations the capacity for acting upon risky events as they occur. Increasing and maintaining a state of collective mindfulness is critical for risk control and mitigation in complex socio-technical systems. A collective mindfulness infrastructure for high reliability is shown in Figure 1 (Weick et al. 1999). PROCESSES Preoccupation with failure Reluctance to simplify interpretations Sensitivity to operations Mindfulness Capability to discover and manage unexpected events Reliability Commitment to resilience Under-specification of structures Figure1. A Mindful Infrastructure for High Reliability Research Model and Hypotheses Offshore business process outsourcing (BPO) projects are very complex undertaking in which organizational actors from different organizations (at least one client and one vendor organization in a single vendor contract, multiple organizations in multi-vendor outsourcing alliances) from different cultural backgrounds and with varying levels of English language proficiency are spread over great geographical distances in multiple countries and perform highly interdependent tasks under tremendous time pressures to take advantage of the 24-hour workday under the follow the sun mantra. Companies face two very different kinds of risk in offshore business process outsourcing: operational risk and structural risk (Aron and Singh, 2005). Operational risk refers to the risk that processes won t operate smoothly after being offshored. The service provider may not be able to execute business processes as well as the outsourcing firm s employees perform them in house. Due to language and cultural barriers as well as geographical distances involved in offshore outsourcing, vendor firms may not be able to elicit and understand the specifications completely and correctly and, thus, may not be able to carry out outsourced tasks correctly and efficiently until they Twenty-Seventh International Conference on Information Systems, Milwaukee 2006 1289
Social, Behavioral and Organizational Aspects of Information Systems move up the learning curve (Aron and Singh, 2005). Operational risk can also be regarded as functional risk which measures the quality of service (QoS) on outsourced processes. Structural risk on the other hand refers to the risk that relationships with service providers may not work out as expected. For instance, offshore service providers may be emboldened to engage in opportunistic behavior and stop investing in training of their employees or employ people who are not as qualified as were initially promised during the negotiation. Service providers may also sometimes put in less effort in the project than they initially agreed to (Aron and Singh, 2005). These are nonfunctional risks and include risks emanating from the measurement of availability, scalability, and security/privacy. The offshore BPO environment is, thus, characterized by a number of risk conditions or factors that can lead to a number of errors and adverse outcomes, some of which were discussed in above. This research proposes that the five processes of collective mindfulness used in HROs and discussed above can be used very effectively in offshore outsourcing contexts to mitigate the impact of offshore outsourcing risk conditions on the potential risky outcomes in offshore outsourcing ventures. This fundamental proposition is captured in the research model shown in Figure 2 below. As mentioned earlier, comprehensive frameworks for risk conditions and risky outcomes will be developed as part of this research and only some illustrative risk conditions and risky outcomes are shown in the research model in Figure 2. Figure2. Research Model Actors in HROs display a chronic worry over failures or potential surprises in order to achieve mindfulness (Weick et al. 1999, Carlo et al. 2004). Bierly and Spender (1995) studied the crew members of a nuclear submarine who were constantly worried about an encounter with a Russian submarine or a reactor accident. Schulman (1993) describes preoccupation with failure as a widespread recognition among organizational actors that all of the potential failure modes into which a highly complex technical system could resolve itself have yet to be experienced. However, there is generally a fundamental reluctance among higher management to put decision or action frameworks in place that are not sensitive to the possibilities of analytic error. Weick et al. (1999) suggest that worries about failure can bring more attentiveness to all risk factors with people treating near misses seriously and becoming more likely to report errors. Many companies nowadays are waking up to the harsh realities of offshoring due to the high cases of failure. Contrary to their expectations of reducing costs and becoming more efficient, half the organizations that shifted business processes offshore failed to generate the financial benefits they expected (Aron et al 2005). In early 2005, both Boston Consulting Group and Gartner Group predicted that 50% of the offshoring contracts that companies in North America have signed between 2001 and 2004 would fail to meet expectations due to problems of cultural collectivism, geographical distance, language proficiency, etc. (Aron et al 2005). In the initial startup stage of an 1290 Twenty-Seventh International Conference on Information Systems, Milwaukee 2006
Li & Kishore/Assuring Offshore IT Service Quality through HRO offshore program, it is hardly ever the case that the service provider is able to execute the business processes as well as they were performed in-house. Until service providers move up the learning curve, they are prone to make more errors and work more slowly as compared to the internal employees. Effective HRO practices encourage both the reporting of errors (Tamuz, 1994) and making the most of any failure that is reported (Weick et al. 1999). Client firms who follow this practice are more likely to learn from their errors quickly and take corrective actions in managing their outsourcing contract with the service provider. Disaster recovery planning is also one extremely important consideration in offshore practice. Critical offshoring business operations should be guaranteed during a disaster that impacts operations at the primary site. If a disaster has rendered the current location for business process operations unusable, the contingency plan in place must be put into action so that the business processes may continue to function using alternate operations site(s). Close attention to the various possibilities for failure can provide keener insights to client firms about risky conditions and risky outcomes who may then ask for and construct complex outsourcing contracts that require the construction and availability of alternate processing sites to ensure uninterrupted operations. This leads to the following hypothesis: H1. A client firm s preoccupation with failure would moderate the impact of risks associated with offshore BPO projects on risky offshore outsourcing outcomes. That is, the higher the level of preoccupation with failure, the lesser is the likelihood of risky outcomes in offshore outsourcing. According to Weick et al. (1999), the issue in simplification is whether the simplified diagnosis of the present and likely future situation is accurate enough to enable the organizational goals to be achieved without encountering unexpected difficulties that lead on to catastrophe. Members in an organization tend to handle complex tasks by simplying the manner in which the current situation is interpreted. However, simplifications are potentially dangerous in HROs (Weick et al. 1999). This is because simplification limits both the precautions people take and the number of undesired consequences they envision. HROs, on the other hand, display negotiated complexity in which a wide range of informal inter-organizational agreements are constantly negotiated and renewed (Schulman 1993, Carlo et al. 2004). IT outsourcing began with the outsourcing of data centers and data processing and has since grown to include the outsourcing of application development, data scrubbing, and off site archiving (Aron, R. et al 2006). Tasks offshored are getting more and more complex, however, and most organizations don t take into account all the risks associated with these complex offshored tasks. Executives use simple cost/benefit analysis to make decisions without really understanding all the risky conditions and potential risky outcomes (Aron et al 2006). Furthermore, outsourcing is no longer an all-or-nothing choice (Aron et al 2006). Client firms have a continuum of options. When the HRO principle of reluctance to simplifying interpretations is practiced, organizations would consider divergent viewpoints as pointed out by Schulman (1993). Divergent perspectives would provide the organization with a broader set of assumptions that sensitize it to a greater variety of inputs (Weick et al. 1999). With diverse viewpoints, client firms would continually re-evaluate their offshoring decisions and contracts. To preserve awareness of simplifications, HROs often implement a novel form of redundancy including duplications and backups (Weick et al. 1999). Many practitioners are quite concerned about risks emanating from complicated offshore projects including such risks as suppliers overselling their capabilities, suppliers encountering subcontracting problems, and Internet security and reliability issues, etc. Due to the physical distance, language proficiency and international communication issues, it becomes much more difficult to monitor the service providers. From this standpoint, multiple and divergent perspectives to understand the current situation are quite important to risk management in offshore outsourcing contexts. A single viewpoint may highly increase the likelihood of eventual surprise. Thus, we propose the following hypothesis: H2. A client firm s reluctance to simplify interpretations moderates the impacts of risks associated with offshore BPO projects on risky offshore outsourcing outcomes. That is, the higher the level of reluctance to simplify interpretations, the lesser is the likelihood of risky outcomes in offshore outsourcing. Sensitivity to operations is a cognitive process where actors comprehend the meaning of the moment while maintaining an integrated image of the overall situation (Vogus and Welbourne 2003). In HROs it is often described as having the bubble (Weick et al. 1999), where having the bubble is similar to the notion of situational Twenty-Seventh International Conference on Information Systems, Milwaukee 2006 1291
Social, Behavioral and Organizational Aspects of Information Systems awareness. For instance, a common problem faced by practitioners in offshore projects is how to formulate appropriate offshore strategies for success. Clearly, the answer differs from business to business (Aron et al. 2005). For example, in a consumer goods industry, management may outsource customer-service related processes first rather than the key product development processes. However, in the hotel industry, executives may regard customerservice processes as key processes, and the opposite may be true. In the 1990 s, customer call centers were mainly considered the target for offshore outsourcing. The most recent wave of offshore business process outsourcing involves many more complex business processes including human resource management processes, finance and accounting processes, remote education services, engineering and design services, etc. Offshore outsourcing management strategies should obviously be quite different for the more knowledge-intensive business processes that are currently being outsourced as compared to the strategies that are used in the context of outsourcing of call centers. The fairly straightforward and routine tasks such as call centers may have few if any strategic implications. However, knowledge and information intensiveness in the nature of the work that is being outsourced today could have important strategic implications for the corporation and requires the integration of information systems and intensive cooperation from all regional offices. In such contexts, situational awareness becomes important for executives in order for them to make the right offshoring management decisions. If the outsourcing project is managed as an HRO, executives will try to comprehend and understand the meaning of the current moment within an integrated framework of the overall situation. In an HRO, executives achieve situational awareness through a combination of shared mental representations, collective story building, multiple bubbles of varying size, situational assessments with continual updates, knowledge of physical interconnections and parameters of plant systems, and active diagnosis of the limitations of preplanned procedures (Weick et al. 1999). These ideas can be implemented in offshore outsourcing contexts as well, and situational awareness and sensitivity to operations can reduce the incidence of surprises and shorten the period of inaction in offshoring projects (Weick et al. 1999). Thus, we propose the following hypothesis: H3. A client firm s sensitivity to operations moderates the risks associated with offshore BPO projects on risky offshore outsourcing outcomes. That is, the higher level of sensitivity to operations, the lesser is the likelihood of risky outcomes in offshore outsourcing. Commitment to resilience refers to the ability to cope with dangers that have occurred through sheer resilience. It argues that the variation rather than invariance in reliability-enhancing activities is necessary to cope with the unexpected (Bigley and Roberts 2001, Weick et al. 1999). On the one hand, HROs pay enormous attention to anticipating possible failure modes; on the other hand, they also develop a capacity for resilience to deal with failures when they occur. In offshore outsourcing contexts, commitment to resilience is associated with the measurement of offshore service availability, scalability and security/privacy. For instance, a service provider may stop investing in training of employees, or employ people who are not as qualified as was promised during the negotiation. The service provider could also sometimes put in less effort than they initially agreed to. Client firms that practice commitment to resilience will develop mechanisms to cope with such failures. Business continuity is also an extremely important topic in offshore outsourcing projects. Client firms practicing the principle of commitment to resilience will also often want a fully-functional duplicate site with a fully-configured computer facility, communication links, and operation resources to cope with the unexpected when the main offshore site goes down. The client firm would desire a capability for near real-time recovery in such situations. The ability to bounce back from errors and mistakes through constrained improvisation is also very important in offshore outsourcing. Client firms using the principle of commitment to resilience may also not invest in alternate processing sites for non-critical business processes, such as payroll processing or report generation, and may be able to deal with failures through constrained improvisation in such cases. Thus, we propose the following hypothesis: H4. A client firm s commitment to resilience moderates the risks associated with offshore BPO projects on risky offshore outsourcing outcomes. That is, the higher level of commitment to resilience, the lesser is the likelihood of risky outcomes in offshore outsourcing. 1292 Twenty-Seventh International Conference on Information Systems, Milwaukee 2006
Li & Kishore/Assuring Offshore IT Service Quality through HRO Under-specification of structures refers to the flexible and fluid decision making to cope with errors and dangers of the moment (Weick et al. 1999). Many real HROs loosen the designation of the important decision maker in order to allow decision making to migrate along with the problem (Weick et al. 1999). As a result, it is possible to access a wider range of capabilities and solutions. Since business process outsourcing is becoming more and more knowledge intensive, many outsourced tasks can not be codified. Because of the variation in the way these tasks are performed, it is difficult to set codified standards for evaluating the quality of execution in an easy manner. Further, some knowledge-intensive processes may need a longer time to stabilize after being outsourced. To cope with these problems, some client firms get their own managers to help the vendors manage the business processes and retain enough in-house expertise to train new providers. Extended organizational relationships between client and vendor firms are set up in order to achieve a close cooperation environment. In such cases, the terms of contracts and outsourcing governance and management practices are negotiated in real time to maximize both groups interests. This flexible and fluid decision making approach helps mitigate the above outsourcing risks. Thus, we propose the following hypothesis: H5. A client firm s under specification of structures moderates the risks associated with offshore BPO projects on risky offshore outsourcing outcomes. That is, the higher level of under specification of structures, the lesser is the likelihood of risky outcomes in offshore outsourcing. Research Methodology The risk framework and the risk management methodology developed as part of the research project will be empirically tested using data that will be collected from US client firms that have BPO projects in major IT hub cities in India and China. Data about risk conditions and risky outcomes from the client firms will be collected. Client firms will be identified through authors direct industry and professional contacts. As there is little research in the area of offshore business process outsourcing, specifically in the area of offshoring risks, we adopt a mixed method approach and combine qualitative research interviews with a quantitative research survey approach following similar approaches in the literature (Ho et al., 2003; Koh et al., 2004). Face-to-face research interviews of selected senior executives, project managers, contract managers, relationship managers, and project team members will be conducted. We anticipate that the research interviews will not only provide rich insights into the processes and techniques used by both clients and service providers and organizations for risk management but will also be used to refine the survey instrument. Interview data will be transcribed and analyzed using qualitative analysis techniques for grounded theory development (Glaser and Strauss 1967) and the survey data will be analyzed using structural equation modeling techniques. Data collection is currently in process. We expect to present and discuss preliminary results at the conference. Conclusions Offshore outsourcing is getting more and more popular nowadays and the issue of risk management is gaining significance. Both industry practitioners and researchers in information systems view risk mitigation in offshore IT and business process outsourcing as a key challenge. Based on the principles of high-reliability organizations, this paper develops a risk management methodology for offshore business process outsourcing contexts. We anticipate that a firm can enable the five cognitive processes underlying collective mindfulness to combat the risks associated with offshore business process outsourcing, which include preoccupation with failure, reluctance to simplify interpretations, sensitivity to operations, commitment to resilience, and under-specification of structures. Data collected from client firms in the US pertaining to offshore business process outsourcing projects in India and China will be used to test the research model. References Aron, R., and Singh, J.V. "Getting offshoring right," Harvard Business Review, December 2005, 135-143 Aron, R., and Singh, J. V. "IT enabled strategic outsourcing: knowledge intensive firms, information work and the extended organizational form," The Wharton School, University of Pennsylvania Working Paper, 2006 Twenty-Seventh International Conference on Information Systems, Milwaukee 2006 1293
Social, Behavioral and Organizational Aspects of Information Systems Bierly III, P. E., and Spender, J. C. "Culture and high reliability organizations: The case of the nuclear submarine," Journal of Management, 1995, pp. 639-656 Bigley, G.A., and Roberts, K.H. "The Incident Command System: high-reliability organizing for complex and volatile task environments," Academy of Management Journal (44:6), 2001, pp. 1281-1299. Carlo, J. L., Lyytinen, K., and Boland, R.J. Jr. "Systemic risk, information technology artifacts, and high reliability organizations: A case of constructing a radical architecture," Twenty-Fifth International Conference on Information Systems, 2004, Washington DC, U.S.A. Carmel, E., and Tjia, P. Offshoring Information Technology: Sourcing and Outsourcing to a Offshore Workforce, Cambridge University Press, New York, NY, 2005. Glaser, B.G., and Strauss, A.L. The Discovery of Grounded Theory: Strategies for Qualitative Research, Aldine Publishing Company, Chicago, IL, 1967. Gopal, R.D., and Sanders, G.L. "International Software piracy: Analysis of key issues and impacts," Information Systems Research (9:4), 1998, pp. 380-397. Grabowski, M., and Roberts, K.H. "Risk mitigation in virtual organizations," Organization Science (10:6), 1999, pp. 704-721. Hannan, M.T., and Freeman, J. "Structural inertia and organizational change," American Sociological Review (49:2), 1984, pp. 149-164. Ho, V.T., Ang, S., and Straub, D. "When subordinates become IT contractors: persistent managerial expectations in IT outsourcing," Information Systems Research (14:1), 2003, pp. 66-86. Kern, T., Willcocks, L.P., and Lacity M.C. "Application service provision: risk assessment and mitigation," MIS Quarterly Executive (1:2), 2002, pp. 113-126 Koh, C., Ang, S., and Straub, D. "IT outsourcing success: a psychological contract perspective," Information Systems Research (15:4), 2004, pp. 356-373. Perrow, C. "Normal accidents: Living with high-risk technologies," New York: Basic Book, 1984 Ramanujam, R., and Goodman, P.S. "Latent errors and adverse organizational consequences: a conceptualization," Journal of Organizational Behavior (24:7), 2003, pp. 815-836. Roberts, K.H. "Some characteristics of one type of high reliability organization," Organization Science (1:2), 1990, pp. 160-176. Schulman, P. R. "The negotiated order of organizational reliability," Administration and Society (25), 1993, 353-372 Tamuz, M. "Developing organizational safety information systems for monitoring potential dangers," Proceedings of PSAM II (2), 1994,7-12 Vogus, T.J., and Welbourne, T.M. "Structuring for high reliability: HR practices and mindful processes in reliability-seeking organizations," Journal of Organizational Behavior (24:7), 2003, pp. 877-903. Waller, M.J., and Roberts, K.H. "High reliability and organizational behavior: finally the twain must meet," Journal of Organizational Behavior (24:7), 2003, pp. 813-814. Weick, K.E., Sutcliffe, K.M., and Obstfeld, D. "Organizing for high reliability: processes of collective mindfulness," Research in Organizational Behavior (21), 1999, pp. 81-123. 1294 Twenty-Seventh International Conference on Information Systems, Milwaukee 2006